Internet Access at your Local Libaries?

gettingOnline asks: "I work for a library that will soon offer public access to our network. You come in with your network ready portable computer, change your config to use DHCP, plug in, and you have T1 access to the net. Other libraries are offering this service already, and there's no doubt we will offer it, no matter what the security issues are. What I want to know from all of the network gurus out there is what we can do, short of creating a separate network, to minimize risk without limiting internet access."

Comments

Create a seperate network

[photon317]

Any solution short of creating a seperate network is really asknig for trouble. It's notmuch trouble or money to segment your network into a "private" ethernet for the librarians' servers and workstations, and a "public" ethernet for random laptops. Fence it up with an OpenBSD or Linux router/firewall box with a few ethernet cards in it and you're done (Linux is more multi-purpose and easier for most - OpenBSD is considerably more rock-solid-secure for a firewall-only box, IMHO).

Lan Parties?

[BumbaCLot]

Will you allow gamers to come in and set up lan games as well?
Personally I would define the 'internet' as too broad to give access to, you would be better off running a proxy for limited 'www access', and creating logins for everyone based on their library card info/etc..

start with your library cards?

[kootch]

why not add a tiny bit of restrictiveness to the system just to prevent people from acting stupid and believing that they are untraceable.

I've seen systems that when you try your first connection using DHCP, you need to input a username and password... often used in new highrise apt complexes that come with broadband.

make the user put in their library card name and number. hell, it's very little information for providing them with broadband access, right?

but I think this might also help when budget time rolls around and the state/county/etc asks you to justify your cost. you then show them usage stats and show how it is a desired service.

I also see lots of other marketing benefits, but it'll take too long to go into them.

Policy first, technology second

[linuxwrangler]

You need to outline the various risks and have the administration determine a policy. That both gives you a basis for your technological decisions and it covers your a**. Start by determining the purpose of allowing access - is it just for web research or do you want to provide other access as well?

Some potential problems:

Unlimited and unlogged access?? What a great place for spammers, crackers and such to get net access.

Everyone on the same subnet (w/o router restrictions)?? Everyone with open Windoze shares will be vulnerable while logged in.

Log all access?? You may run afoul of privacy concerns and laws.

If you only intend to provide http(s) and ftp you might consider putting users behing a Squid proxy to improve speed and help limit access (not a substitute for firewalling, though).

I would in any case make sure that the IP (or even entire connection) you use is separate from your administrative connection so if something bad happens (you provided full access and got blacklisted for spam for instance), your administrative functions will not be impaired.